The present invention relates generally to a method and apparatus for safeguarding data stored in memory and specifically to a method to prevent unauthorized access to data stored temporarily in a nonvolatile memory, such as a hard disk drive.
Digital copiers, laser printers, facsimile machines, document scanners, computers, cellular telephones, digital cameras, and multifunction devices possess several properties in common. All these devices are capable of processing a digital image of a document (“image,” “data,” “image data,” or “image data file”). If the device is able to “read” a document, it typically includes a scanner component, and if the device is able to print a document, it typically includes a printer component. Additionally, these devices typically incorporate a memory. These devices may be collectively referred to as “digital document processors.”
Digital document processors may perform one or more of the following operations: scanning, storing, transmitting, reading, viewing, printing, and deleting. Depending on the particular digital document processor, additional operations may also be performed.
A digital document processor may be able to perform the operation of scanning an original document. The document is illuminated and a charge coupled device or a contact image sensor converts the reflected image into a plurality of electrical signals that together create a digital image of the original document. All or part of the scanned image data is typically stored in a memory.
A digital document processor may be able to perform the operation of printing image data stored in a memory. One type of printing, laser printing, may be accomplished by reading image data from memory in another digital document processor (such as a computer) and using the data to turn a laser beam on and off as the beam scans a charged drum. Where the laser beam strikes the drum, charges are neutralized. Areas not exposed to the beam attract toner powder which is transferred to paper passing over the drum. Pressure applied to the paper as it passes over the drum fuses the toner powder to the paper. The image data stored in memory is thus converted to a physical representation on paper. The image data may also be read from the digital document processor's memory. For example, to accommodate the slower speed of a printer without idling a computer's faster input/output bus, image data in computer memory may be buffered in a printer memory. In addition, confidential or secure image data may be stored in a digital document processor's memory and not printed until an authorized user enters a personal identification number. In this way, a user may send a confidential document to a printer and the document will not print until the user is present.
A digital document processor may be able to perform the operation of copying an original document. By storing image data to memory, multiple copies can be made without repeatedly inputting an original document. In addition, storing image data to memory permits image size, orientation, and page sequence to be modified prior to printing. For example, two original 8½″ by 11″ images stored in memory may be rotated 90 degrees, reduced in size, and printed side-by-side on one side of a single 8½″ by 11″ sheet of paper. As a further example, a large number of original images may be reduced, reoriented, and printed side-by-side on the front and back sides of sheets of paper in a sequence different from the copy sequence in book format.
As exemplified by the scanning, printing, and copying operations, most operations use memory at one or more steps. A transmitting operation, for example, stores image data in a facsimile memory so that an image can be transmitted later or so that images can be simultaneously transmitted and received. In addition, memory is used in digital document processors for other purposes readily apparent to one skilled in the art.
A document may be represented in memory as a bit-mapped image. A bit map is a representation of an original document that consists of rows and columns of dots. The value of each dot may be stored in memory as a single bit to represent a black or white value, or as a byte or several bytes for shades of gray or for colors. Documents may be stored using other storage schemes, but they are all based on a binary code that uses ones (“positives”) or zeros (“negatives”). Throughout this document, storage schemes may be discussed in terms of bit mapping, but one skilled in the art could apply the same principles to other storage schemes.
Memory may include both volatile memory and nonvolatile memory. “Nonvolatile memory” means any memory having the property of retaining stored data when electrical power fails or is turned off. Examples of nonvolatile memory include hard disks, floppy disks, optical disks, compact disks (“CDs”), digital versatile disks (“DVDs”), tape drives, and various integrated circuit (“IC”) memories, as further defined below.
Nonvolatile memory devices, such as floppy disks, hard disks, magnetic tape, optical disks, CDs, and DVDs, are made from media that can be permanently altered to store a bit of information. In the case of floppy disks, hard disks, and magnetic tape, data is stored by writing a pattern of magnetic fields on a magnetic material. Data is read by sensing the presence of a magnetic field and its direction. In the case of optical disks, CDs, and DVDs, a laser is used to form and read bumps on a plastic media.
IC devices such as erasable programmable read-only memory (“EPROM”), electrically erasable programmable read-only memory (“EEPROM”), flash erasable programmable read-only memory, nonvolatile random access memory (“NVRAM”), and flash memory chips represent another type of nonvolatile memory. In these devices, data is represented by electric charges stored on insulated gates. Another type of IC nonvolatile memory is a static random access memory with a battery backup.
With disk type nonvolatile memory, a portion of each disk may store a directory for the disk. To locate a particular data file, the directory is used to identify the location where the data is stored. The directory is also used to identify “free” locations where new data may be stored. In addition, before a disk can be used it may require formatting to define locations where data may be stored. When a user issues a command to format a disk containing previously stored data, only the directory is updated to indicate locations where data may be stored. Similarly, when a user issues a command to delete a file stored on a disk, only the directory is updated. Alternatively, data on a disk may be stored and retrieved using a linked list data structure instead of a table. When a user issues a delete command, only a pointer to the data is updated. In all three situations, however, data remains on the disk until it is later overwritten.
Even when image data is overwritten with new information, a substantial portion or residual elements of the overwritten information may remain on the disk. First, modern disks commonly use data compression and multibit coding techniques. With these techniques, overwriting all zeros, for example, results in writing a single zero and a follow-on code indicating the length of the run. These techniques may result in substantial portions of the original information remaining on the disk. Second, the pattern of magnetization on a disk is modified when image data is stored. Traces of the modified pattern of magnetization remain even after it is overwritten. Sophisticated techniques have been developed that sense subtle changes in magnetization and enable the overwritten information to be recovered from residual elements.
A disadvantage of nonvolatile memory or storage devices is that the stored data may be viewed by unauthorized persons. Because nonvolatile memory retains stored data when electrical power fails or is turned off, it is possible to remove a nonvolatile memory device from a digital document processor, install the memory in a computing system, and use the computing system to read data stored in the nonvolatile memory. A further disadvantage of nonvolatile storage devices is that even when data has been “erased,” it may still be possible to recover and read the information. Data may be recovered and read because only a directory entry or a pointer to the data was erased, because data compression or multibit coding techniques do not overwrite a substantial portion of the data, or because sophisticated techniques may be used to detect residual elements of a magnetic pattern remain on the disk even after an overwrite.
The security risk associated with memory being readable after it is removed from a digital document processor has been recognized, and security solutions for protecting the confidentiality of data stored in memory have been attempted.
Some types of security solutions erase the entire memory. For example, degaussing may be used to neutralize or demagnetize an entire magnetic memory. Physical destruction may be used to prevent access to an entire optical memory. The entire memory of an IC device, such as an EPROM, may be erased by shining an ultraviolet light through a quartz window in the top of the package. In other ICs, such as an EEPROM, the entire memory may be electrically erased by downloading a bit sequence to the device.
Because data is generally recoverable if it is merely “deleted” or “erased” by a software program, the overwriting security solution was developed to obscure or conceal the data. When information is identified as sensitive or a security risk, a specific overwriting instruction is made. Alternatively, data may kept for a predefined period until the memory is needed again and then overwritten.
Overwriting refers to storing new useful data or a meaningless bit pattern at the memory location of the data to be erased. When overwriting is used to conceal information, the overwritten bit pattern may be all ones, all zeros, or any predetermined sequence of binary values. Alternately, the bit pattern may be a random or pseudo-random pattern of binary values (“random bit mask”). A pseudo-random number sequence is so named because an identical sequence of numbers is created each time the generator is invoked, and the sequence eventually repeats. An advantage of overwriting with a random bit mask is that the ability of sophisticated techniques to reconstruct the original data from residual elements is significantly diminished.
Several government agencies have established standards for overwriting data stored on a hard disk drive. Typically, these standards require two or more overwrite operations. The Department of Defense, for example, requires three overwrites: (1) a binary value is written, (2) a complementary binary value is written, and (3) a random value is written.
PowerQuest's DATAGONE™ is a commercially available software program that erases data from a hard disk using overwriting operations. DATAGONE™ erases an entire partition of a hard drive. White Canyon Software's SECURECLEAN™ is another software program that erases data from a hard disk by performing overwrite operations at the file level.
Windmill Software Ltd.'s Windmill Logger is a data acquisition software program that exemplifies the use of an overwriting operation to conserve space on a hard disk drive. To prevent a user's hard disk drive from being filled with data, the user may specify a set of data files that may be reused. For example, seven data files, one for each day of the week, may be specified. When all seven specified files are full, data in the first file is automatically overwritten with new data. On the next day, the second data file is over-written, etc.
U.S. Pat. No. 6,012,145 to Mathers, et al. (“the Mathers reference”) discloses another means for securing nonvolatile memory. Specifically, the Mathers reference discloses a password security system for protecting information recorded on the portable hard disk drives that are typically used in laptop portable computers. The Mathers reference requires an additional microprocessor, a keyboard, a display, and an operating system. While the Mathers reference provides a security means for portable hard disk drives, the additional hardware and software required make it expensive and impractical for use with hard disk drives incorporated into digital document processors other than portable laptop computers.
Ukai, et al., U.S. Pat. No. 5,642,199, (“the Ukai reference”) discloses a digital copier or a complex copier having a facsimile function with a security function for keeping a record of persons who copied or transmitted images and the dates of copying or transmission. In addition, the type of image may be recorded, or a “thinned” version of the document image may be saved. While the Ukai reference discloses a means for identifying the person who may have had unauthorized access to a document, it does not prevent unauthorized access to a document.